Does your website track visitors before they consent? Find out in a minute

Here is a question most website owners cannot answer: what does your site do to a visitor who has not clicked anything yet?

You probably think you know. But your own browser said yes to your cookie banner months ago, so every time you visit your own site, you see the version for someone who has already agreed. The first-time visitor's version, the one the consent rules are actually about, is the one you never see.

So we built a scanner that shows it to you. It is free, it needs no sign-up, and it lives at galytics.net/scan.

What the scanner does

You type in a domain. A fresh browser with an empty profile loads the homepage. It clicks nothing. It waits for the page to settle, scrolls once, waits a few more seconds, and then writes down everything that happened before anyone could say yes or no:

• Every cookie that was set, who set it, and how long it lives. Values are never stored.
• Every outside domain the page called. Each of those received the visitor's IP address.
• Every browser storage key, because plenty of trackers keep their IDs in localStorage instead of a cookie.
• Whether a consent banner was shown, and which tool it came from.

Each scan gets its own public report page at galytics.net/scan/your-domain, so you can send it to a colleague, your web agency, or whoever told you the site was compliant.

What a clean result looks like

We hold our own site to the same standard. The report for galytics.net says: before any consent, galytics.net set 2 cookies and contacted 0 other domains. The two cookies are a session cookie and a security token for forms, and neither one tracks anyone.

The report also lists a small beacon from the CDN that delivers the site, under "the host's own services". When a page is already delivered through a CDN, a request to that same CDN does not send the visitor's IP address anywhere new. That rule applies to every site we scan, ours included. A scanner that went easy on its own domain would be worthless.

The most common reasons a site fails

Most sites that set things before consent are not doing it on purpose. The usual causes are small and easy to miss:

Analytics and marketing tags that fire on page load. The banner appears, but the tags behind it were never told to wait for an answer. This is the big one, and it shows up in the report as cookies like _ga or _fbp before anyone has clicked.

Fonts loaded from Google's servers. Every visitor's browser contacts Google before the page has even rendered. It sounds harmless, and in January 2022 a Munich court ordered a website owner to pay damages for exactly this, because it hands the visitor's IP address to Google without consent. Serving the fonts from your own domain fixes it.

Scripts included on every page that only one page needs. A spam check for a contact form, a map widget, a chat bubble. If the script is in the site-wide template, every visitor's browser calls that outside service, whether they ever open the contact page or not. Load it only where it is used.

Embedded videos and social widgets. A video player from a big platform usually sets its own cookies the moment it loads. Many have a privacy-friendly embed mode, or you can show a thumbnail that only loads the player when clicked.

What the report shows, and what it does not

The report states what happened. It never says a site is "illegal" or "not GDPR compliant", because a scan cannot see a site's legal basis, only its behaviour. A few more limits worth knowing:

• Only the homepage is scanned. Other pages may behave differently.
• Cookie descriptions are matched by name. We look names up in a public database of known cookies, so _ga is shown as a Google Analytics identifier and _fbp as Facebook's advertising cookie. A name tells you what a cookie is commonly used for, not proof of who set it, and cookies a site invents for itself usually have no description at all.
• Some sites block the scan. Bot protection sometimes answers our browser with an error page. When that happens, the report says the site blocked the scan and publishes no findings, because what we saw is not what a real visitor gets.

If you own a site and want its report removed, tell us.

How consent banners are detected

Consent banners are recognised by how they look on the page, not by where their script comes from. That matters because many banners are served from the site's own domain, where no list of domains would catch them. The scanner only notices the banner: it never clicks, hides or answers it.

Try it

Scan your site. It takes under a minute.

If the report shows analytics cookies before consent, that is the problem Galytics was built to remove. It measures your traffic without cookies, so there is nothing to ask consent for and nothing to put in a banner. You can try it free for 30 days.